mixdog 1.2.2 → 1.2.4

package/src/session-runtime/services/agent-tool/tag-registry.mjs

@@ -1,7 +1,7 @@
 // Tag registry: owns the tag maps (tag -> sessionId/agent/cwd) and every
 // resolution/mutation path — resolve/next/bind/forget and the session-index
 // refresh. Worker-index persistence lives in worker-index.mjs and terminal
-// tombstones/reap timers in terminal-reaper.mjs; the tag maps are shared by
+// tombstones in terminal-reaper.mjs; the tag maps are shared by
 // reference so all three sides see the same live state.
 import { agentTagOf } from './helpers.mjs';
 import { createLeadWorkerIndex } from './lead-worker-index.mjs';
@@ -27,9 +27,10 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     dataDir,
     cfgMod,
     workerRowFromSession: index.workerRowFromSession,
+    isSessionRunning: (sessionId) => mgr.isSessionTurnInFlight?.(sessionId) === true,
   });
 
-  const { upsertLeadSession, updateLeadWorkerCwd } = leadIndex;
+  const { upsertLeadSession, updateLeadWorkerCwd, forgetLeadSession } = leadIndex;
 
   function dispose(options) {
     try {
@@ -39,6 +40,17 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     }
   }
 
+  /** Drain every queued index write (batches included) without disposing. */
+  async function flushIndexWrites() {
+    await Promise.all([index.flushWorkerIndexWrites(), leadIndex.flushLeadWorkerIndexWrites()]);
+  }
+
+  async function disposeAsync(options) {
+    const results = await Promise.allSettled([index.disposeAsync(), leadIndex.disposeAsync(options)]);
+    const failed = results.find((result) => result.status === 'rejected');
+    if (failed) throw failed.reason;
+  }
+
   function getLiveSession(sessionId) {
     if (!sessionId) return null;
     const session = mgr.getSession(sessionId);
@@ -55,7 +67,7 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     return null;
   }
 
-  const reaper = createTerminalReaper({ cfgMod, mgr, tagMaps, index, getLiveSession, tagForSession });
+  const reaper = createTerminalReaper({ cfgMod, mgr, tagMaps, index, getLiveSession });
 
   function wantsSessionScan(args = {}) {
     return args.recover === true || args.scanSessions === true || args.scan_sessions === true;
@@ -91,10 +103,10 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     removeWorkerRow({ tag, sessionId });
   }
 
-  reaper.recoverTerminalReaps();
-
   return {
     dispose,
+    disposeAsync,
+    flushIndexWrites,
     readAllTagTombstones: index.readAllTagTombstones,
     readTagTombstones: index.readTagTombstones,
     readWorkerRows,
@@ -104,12 +116,12 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     upsertWorkerSessionDeferred,
     upsertLeadSession,
     updateLeadWorkerCwd,
+    forgetLeadSession,
     removeWorkerRow,
     refreshTagsFromIndex,
     tags,
     tagAgents: tagMaps.tagAgents,
     tagCwds: tagMaps.tagCwds,
-    reapTimers: reaper.reapTimers,
     wantsSessionScan,
     resolveTag,
     getLiveSession,
@@ -124,10 +136,6 @@ export function createTagRegistry({ dataDir, cfgMod, mgr }) {
     tombstoneTerminalSession: reaper.tombstoneTerminalSession,
     tagTombstoneForTag: reaper.tagTombstoneForTag,
     consumeTagTombstone: reaper.consumeTagTombstone,
-    cancelReap: reaper.cancelReap,
-    clearScheduledReaps: reaper.clearScheduledReaps,
-    scheduleReap: reaper.scheduleReap,
-    recoverTerminalReaps: reaper.recoverTerminalReaps,
     transitionStaleNonterminalRows: reaper.transitionStaleNonterminalRows,
   };
 }

package/src/session-runtime/services/agent-tool/terminal-reaper/scan-admission.mjs

@@ -1,13 +1,11 @@
 // Session-scan admission: whether a scan may (re)index a session, and how a
-// terminal session's frozen stamps translate into the reap deadline that the
-// scan then settles through the timers.
-import { agentTagOf, clean, stampMs } from '../helpers.mjs';
+// terminal session's frozen stamps are re-emitted onto its row.
+import { clean, stampMs } from '../helpers.mjs';
 import { isTerminalWorkerStatus } from '../worker-rows.mjs';
 import { ACTIVE_STAGES } from '../tool-def.mjs';
-import { resolveAgentTerminalReapMs } from '../../../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
 import { sessionActivityAt } from './row-helpers.mjs';
 
-export function createScanAdmission({ cfgMod, mgr, index, tombstoneBlocksScan, timers }) {
+export function createScanAdmission({ mgr, index, tombstoneBlocksScan }) {
   const { readWorkerRows, upsertWorkerSessionDeferred } = index;
 
   function scanSessionIsTerminal(session) {
@@ -23,7 +21,7 @@ export function createScanAdmission({ cfgMod, mgr, index, tombstoneBlocksScan, t
   /** Extra fields for a scan/rebind upsert of an already-terminal session. The
    * default row build stamps updatedAt = now and clears reapAt, which restarts
    * the lease from the read instead of from the work: a terminal session owns
-   * its frozen stamps, and its deadline is derived from them. Returns null for
+   * its frozen stamps, which are kept as-is with no reap deadline. Returns null for
    * running/active sessions so they keep the normal (now-based) behavior. */
   function terminalScanExtra(session) {
     if (!scanSessionIsTerminal(session)) return null;
@@ -34,56 +32,25 @@ export function createScanAdmission({ cfgMod, mgr, index, tombstoneBlocksScan, t
     const stamp = new Date(terminalAtMs).toISOString();
     const sessionId = clean(session?.id);
     const existing = readWorkerRows().find((row) => clean(row.sessionId) === sessionId) || null;
-    const reapMs = resolveAgentTerminalReapMs(
-      cfgMod.loadConfig(),
-      clean(existing?.provider) || clean(session?.provider)
-    );
-    // An existing lease is authoritative: a read must never extend or reset it.
-    const existingReapMs = stampMs(existing?.reapAt);
-    let reapAt = null;
-    if (existingReapMs > 0) reapAt = new Date(existingReapMs).toISOString();
-    else if (reapMs != null) reapAt = new Date(terminalAtMs + reapMs).toISOString();
     const finishedMs = stampMs(session?.finishedAt) || stampMs(existing?.finishedAt);
     return {
       // Stamps are re-emitted as ISO so a numeric session stamp cannot leak an
       // unparseable value into the row store.
       updatedAt: stamp,
       finishedAt: finishedMs > 0 ? new Date(finishedMs).toISOString() : stamp,
-      reapAt,
+      reapAt: null,
     };
   }
 
   // Shared session-scan admission: returns false when the scan must not
   // resurrect this session, otherwise indexes it (terminal sessions with their
-  // own stamps) and records any terminal deadline for settlement.
-  function scanUpsertSession(session, tag, tombstones, pendingTerminal) {
+  // own stamps).
+  function scanUpsertSession(session, tag, tombstones) {
     if (tombstoneBlocksScan(session, tag, tombstones)) return false;
     const extra = terminalScanExtra(session);
     upsertWorkerSessionDeferred(session, tag, extra || {});
-    if (extra?.reapAt) {
-      pendingTerminal.push({
-        tag: agentTagOf(session) || clean(tag),
-        sessionId: clean(session.id),
-        reapAt: extra.reapAt,
-      });
-    }
     return true;
   }
 
-  /** Arm (or immediately run) the reap for rows a scan just (re)indexed. An
-   * already-elapsed deadline is reaped now instead of buying a new window. */
-  function settleScannedTerminalRows(pendingTerminal) {
-    if (!pendingTerminal.length) return;
-    const now = Date.now();
-    for (const row of pendingTerminal) {
-      const deadline = stampMs(row.reapAt);
-      if (!deadline) continue;
-      // reapTerminalRow -> tombstoneTerminalSession flushes the deferred upsert
-      // first, so the row it matches on is the one this scan just wrote.
-      if (deadline <= now) timers.reapTerminalRow(row);
-      else if (!timers.isArmedFor(row.sessionId, row.reapAt)) timers.schedulePersistedReap(row);
-    }
-  }
-
-  return { scanUpsertSession, settleScannedTerminalRows };
+  return { scanUpsertSession };
 }

package/src/session-runtime/services/agent-tool/terminal-reaper/stale-rows.mjs

@@ -1,5 +1,5 @@
 // Stale non-terminal rows: an index row whose session is gone and whose
-// heartbeat is older than the reap window becomes a tombstone so its tag is
+// last row stamp is older than the reap window becomes a tombstone so its tag is
 // freed instead of blocking spawn forever.
 import { clean, positiveInt } from '../helpers.mjs';
 import { TAG_TOMBSTONE_TTL_MS, isLeadPoolAgent, workerRowTime } from '../worker-rows.mjs';
@@ -16,9 +16,9 @@ export function createStaleRowTransition({ cfgMod, tagMaps, index, getLiveSessio
       if (getLiveSession(clean(row.sessionId))) return false;
       const rowTime = workerRowTime(row);
       const reapMs = resolveAgentTerminalReapMs(cfgMod.loadConfig(), row.provider);
-      // A row with no timestamp has no usable heartbeat at all. Explicitly
+      // A row with no timestamp has no usable stamp at all. Explicitly
       // disabled terminal reaping still gets the tombstone TTL as a finite
-      // stale-heartbeat bound, so malformed/running index rows cannot block a
+      // staleness bound, so malformed/running index rows cannot block a
       // tag forever.
       return rowTime <= 0 || Date.now() - rowTime >= (reapMs ?? TAG_TOMBSTONE_TTL_MS);
     });

package/src/session-runtime/services/agent-tool/terminal-reaper.mjs

@@ -1,46 +1,29 @@
-// Terminal-session reaping for the agent tag registry: tag tombstones, the
-// scan admission guard they impose, the delayed reap timers and their
-// recovery after a restart. Reaping expires only the tag/runtime lease — the
-// session record stays open so the transcript remains visible from the parent
-// task. Each concern lives under ./terminal-reaper/; this file wires them.
+// Terminal-session bookkeeping for the agent tag registry: tag tombstones, the
+// scan admission guard they impose and stale worker-row transitions. Terminal
+// sessions are never closed on a timer — the session record stays open so the
+// transcript remains visible from the parent task. Each concern lives under
+// ./terminal-reaper/; this file wires them.
 import { createTagTombstones } from './terminal-reaper/tombstones.mjs';
-import { createReapTimers } from './terminal-reaper/reap-timers.mjs';
 import { createScanAdmission } from './terminal-reaper/scan-admission.mjs';
 import { createStaleRowTransition } from './terminal-reaper/stale-rows.mjs';
 
-export function createTerminalReaper({ cfgMod, mgr, tagMaps, index, getLiveSession, tagForSession }) {
+export function createTerminalReaper({ cfgMod, mgr, tagMaps, index, getLiveSession }) {
   const tombstones = createTagTombstones({ tagMaps, index });
-  const timers = createReapTimers({
-    cfgMod,
-    mgr,
-    index,
-    getLiveSession,
-    tagForSession,
-    tombstoneTerminalSession: tombstones.tombstoneTerminalSession,
-  });
   const scan = createScanAdmission({
-    cfgMod,
     mgr,
     index,
     tombstoneBlocksScan: tombstones.tombstoneBlocksScan,
-    timers,
   });
   const { transitionStaleNonterminalRows } = createStaleRowTransition({ cfgMod, tagMaps, index, getLiveSession });
 
   return {
-    reapTimers: timers.reapTimers,
     tagTombstoneIndex: tombstones.tagTombstoneIndex,
     tombstoneBlocksScan: tombstones.tombstoneBlocksScan,
     scanUpsertSession: scan.scanUpsertSession,
-    settleScannedTerminalRows: scan.settleScannedTerminalRows,
     forgetTerminalSession: tombstones.forgetTerminalSession,
     tombstoneTerminalSession: tombstones.tombstoneTerminalSession,
     tagTombstoneForTag: tombstones.tagTombstoneForTag,
     consumeTagTombstone: tombstones.consumeTagTombstone,
-    clearScheduledReaps: timers.clearScheduledReaps,
-    cancelReap: timers.cancelReap,
-    scheduleReap: timers.scheduleReap,
-    recoverTerminalReaps: timers.recoverTerminalReaps,
     transitionStaleNonterminalRows,
   };
 }

package/src/session-runtime/services/agent-tool/terminal-trace.mjs

@@ -31,7 +31,6 @@ export function createTerminalTrace({ registry }) {
     if (!row) return false;
     registry.refreshTagsFromSessions({ context });
     const sessionId = clean(row.sessionId);
-    if (sessionId) registry.cancelReap(sessionId);
     registry.forgetTerminalSession(value, sessionId);
     return true;
   }

package/src/session-runtime/services/agent-tool/tool-def.mjs

@@ -53,6 +53,13 @@ export const AGENT_TOOL = {
       file: { type: 'string', description: 'Path to task text; alternative to prompt/message for spawn/send.' },
       cwd: { type: 'string', description: 'Project directory for a new or respawned agent.' },
       context: { type: 'string', description: 'Extra context for the spawn/send turn.' },
+      model: {
+        type: 'string',
+        description:
+          "Spawn only, and only when the user explicitly names a model: runs this one spawn on it instead of the agent's preset route, which stays the default (omit otherwise). Id, display name, or words of it; ambiguous or unknown names fail with candidates. The agent still supplies role and permissions.",
+      },
+      provider: { type: 'string', description: 'Narrows model to one provider; requires model.' },
+      effort: { type: 'string', description: 'Reasoning effort for an explicit model.' },
     },
     required: ['type'],
     additionalProperties: false,

package/src/session-runtime/services/agent-tool/worker-index/row-liveness.mjs

@@ -1,9 +1,6 @@
 // worker-index/row-liveness.mjs
 // Whether an active-looking row still has a live worker behind it, and how a
-// row settles back to idle when it does not.
-import { statSync } from 'node:fs';
-import { resolve } from 'node:path';
-
+// row settles (idle, or failed when its runtime died) when it does not.
 import { resolveAgentTerminalReapMs } from '../../../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
 import { clean, positiveInt, runtimeAlive } from '../helpers.mjs';
 
@@ -25,24 +22,33 @@ export const isActiveWorkerRow = (row) =>
  *  with that process (daemon restart), so the flag must not stick. */
 export const isStaleApprovalWait = (row) => Boolean(row?.awaitingUser) && !runtimeAlive(row.runtimePid);
 
-export function createRowLiveness({ dataDir, cfgMod }) {
-  function heartbeatFresh(sessionId, now) {
-    const id = clean(sessionId);
-    if (!dataDir || !id) return false;
-    try {
-      const mtimeMs = statSync(resolve(dataDir, 'sessions', `${id}.hb`)).mtimeMs || 0;
-      return mtimeMs > 0 && now - mtimeMs <= WORKER_POOL_FRESH_MS;
-    } catch {
-      return false;
-    }
-  }
+/** The process that ran the row's turn is gone (a restart or crash ended it). */
+export const runtimeDied = (row) => Boolean(positiveInt(row?.runtimePid)) && !runtimeAlive(row.runtimePid);
+
+/** The row's turn ended because the process running it went away. */
+export const PROCESS_RESTART_FAILURE = 'process-restart';
 
-  /** Active status, but its runtime pid is dead, or neither its heartbeat nor
-   *  its own update stamp is fresh. */
+/** The row's turn was stopped by the progress (stall) watchdog. */
+export const WATCHDOG_STALL_FAILURE = 'stalled';
+
+/** A turn's settled row status and failure reason: a watchdog stop is a
+ *  failure whatever partial output it handed back (`finalStatus` may still
+ *  read `idle` for the job's sake); everything else keeps `finalStatus`. */
+export function settledWorkerStatus(finalStatus, stalled) {
+  return stalled
+    ? { status: 'failed', stage: 'failed', failureReason: WATCHDOG_STALL_FAILURE }
+    : { status: finalStatus, stage: finalStatus };
+}
+
+/** `isSessionRunning(sessionId)`: the daemon's in-memory answer to whether
+ *  that session's turn is in flight (every session runs in this process). */
+export function createRowLiveness({ cfgMod, isSessionRunning = () => false }) {
+  /** Active status, but its runtime pid is dead, or its turn is not running
+   *  here and its own update stamp is not fresh either. */
   function isStaleActive(row, now) {
     if (!isActiveWorkerRow(row)) return false;
-    if (positiveInt(row.runtimePid) && !runtimeAlive(row.runtimePid)) return true;
-    if (heartbeatFresh(row.sessionId, now)) return false;
+    if (runtimeDied(row)) return true;
+    if (isSessionRunning(clean(row.sessionId))) return false;
     const updated = Date.parse(clean(row.updatedAt)) || 0;
     return !(updated > 0 && now - updated <= WORKER_POOL_FRESH_MS);
   }
@@ -74,5 +80,11 @@ export function createRowLiveness({ dataDir, cfgMod }) {
     };
   }
 
-  return { isStaleActive, idleRow };
+  /** The row settled as failed: its turn never finished, and `failureReason`
+   *  says why. Stamps settle exactly as idleRow's. */
+  function failedRow(row, now, failureReason, touch = false) {
+    return { ...idleRow(row, now, touch), status: 'failed', stage: 'failed', failureReason };
+  }
+
+  return { isStaleActive, idleRow, failedRow };
 }

package/src/session-runtime/services/agent-tool/worker-index/row-shape.mjs

@@ -52,6 +52,9 @@ export function normalizeWorkerRows(value) {
       cwd: clean(row.cwd) || null,
       task_id: clean(row.task_id || row.taskId) || null,
       error: clean(row.error) || null,
+      // Why a `failed` row failed (row-liveness, a watchdog stop). Always
+      // present, so a later whole-row write clears a stale reason.
+      failureReason: clean(row.failureReason) || null,
       permission: clean(row.permission) || null,
       toolPermission: clean(row.toolPermission) || null,
       messages: positiveInt(row.messages) || 0,
@@ -101,14 +104,14 @@ export function workerRowFromSession(session, fallbackTag = '', extra = {}, getS
     // Turn dispatch stamps this; terminal upserts leave it null and the
     // merge in applyWorkerRowUpsert preserves the running turn's value.
     turnStartedAt: clean(extra.turnStartedAt) || null,
-    // Active/new work clears the previous lease. Terminal settlement writes
-    // the new absolute deadline immediately afterwards via scheduleReap().
+    // Kept for compatibility with older worker rows; no timer consumes it.
     reapAt: clean(extra.reapAt) || null,
     clientHostPid: positiveInt(extra.clientHostPid) || positiveInt(session?.clientHostPid),
     runtimePid: positiveInt(extra.runtimePid) || process.pid,
     cwd: clean(session?.cwd) || clean(extra.cwd) || null,
     task_id: clean(extra.task_id || extra.taskId) || null,
     error: clean(extra.error) || null,
+    failureReason: clean(extra.failureReason) || null,
     permission: clean(session?.permission) || null,
     toolPermission: clean(session?.toolPermission) || null,
     messages: Array.isArray(session?.messages) ? session.messages.length : 0,

package/src/session-runtime/services/agent-tool/worker-index/row-store.mjs

@@ -157,6 +157,7 @@ export function createWorkerRowStore(file) {
     flush: queue.flush,
     /** Exit path: persist what is still queued, synchronously. */
     flushSync: queue.flushSync,
+    hasUnpersisted: queue.hasUnpersisted,
     invalidate: () => {
       dirty = true;
     },
@@ -183,7 +184,15 @@ export function acquireWorkerRowStore(file) {
       if (released) return;
       released = true;
       entry.refs -= 1;
-      if (entry.refs === 0 && sharedStores.get(key) === entry) sharedStores.delete(key);
+      const dropIfIdle = () => {
+        if (entry.refs === 0 && !entry.store.hasUnpersisted() && sharedStores.get(key) === entry) {
+          sharedStores.delete(key);
+        }
+      };
+      // A store still holding unpersisted writes stays shared (a new holder
+      // must see them) until its queue drains.
+      if (entry.refs === 0 && entry.store.hasUnpersisted()) entry.store.flush().then(dropIfIdle, () => {});
+      else dropIfIdle();
     },
   };
 }

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -18,7 +18,13 @@ import {
   registerApprovalWaitWriter,
 } from './worker-index/approval-wait.mjs';
 import { createMutationBatch } from './worker-index/mutation-batch.mjs';
-import { createRowLiveness, isActiveWorkerRow, isStaleApprovalWait } from './worker-index/row-liveness.mjs';
+import {
+  createRowLiveness,
+  isActiveWorkerRow,
+  isStaleApprovalWait,
+  PROCESS_RESTART_FAILURE,
+  runtimeDied,
+} from './worker-index/row-liveness.mjs';
 import { normalizeWorkerRows, workerRowFromSession } from './worker-index/row-shape.mjs';
 import { acquireWorkerRowStore } from './worker-index/row-store.mjs';
 import { findTagTombstone, tagTombstoneKey, tombstoneBlocksWork } from '../../../runtime/shared/agent-reap-state.mjs';
@@ -35,9 +41,13 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     unreconciled.clear();
     for (const id of ids) reconcileAwaitingUser(id);
   });
-  const liveness = createRowLiveness({ dataDir, cfgMod });
-  // Rows this process marked active; settled to idle on exit so a crash of
-  // the host never leaves them "running" forever.
+  const liveness = createRowLiveness({
+    cfgMod,
+    isSessionRunning: (sessionId) => mgr.isSessionTurnInFlight?.(sessionId) === true,
+  });
+  // Rows this process marked active; settled as failed on exit (their turn
+  // dies with the process) so a crash of the host never leaves them
+  // "running" forever.
   const activeWorkerKeys = new Set();
 
   function readWorkerRows(context = {}) {
@@ -144,13 +154,17 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
       for (const key of keys) {
         const current = byKey.get(key);
         if (!current || positiveInt(current.runtimePid) !== process.pid) continue;
-        if (isActiveWorkerRow(current)) byKey.set(key, liveness.idleRow(current, now, true));
+        if (isActiveWorkerRow(current)) {
+          byKey.set(key, liveness.failedRow(current, now, PROCESS_RESTART_FAILURE, true));
+        }
       }
     });
   }
 
-  // Startup recovery: stale active rows settle to idle, and an approval wait
-  // left behind by a runtime that is gone (daemon restart) is cleared.
+  // Startup recovery: stale active rows settle — as failed when the process
+  // that ran their turn is gone (the turn never finished), otherwise to idle —
+  // and an approval wait left behind by a runtime that is gone (daemon
+  // restart) is cleared.
   function recoverStaleWorkerRows() {
     const now = Date.now();
     const rows = store.readAll();
@@ -162,7 +176,13 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
         for (const row of staleActive) {
           const key = workerRowKey(row);
           const current = byKey.get(key);
-          if (current && liveness.isStaleActive(current, now)) byKey.set(key, liveness.idleRow(current, now));
+          if (!current || !liveness.isStaleActive(current, now)) continue;
+          byKey.set(
+            key,
+            runtimeDied(current)
+              ? liveness.failedRow(current, now, PROCESS_RESTART_FAILURE)
+              : liveness.idleRow(current, now)
+          );
         }
       });
     }
@@ -173,7 +193,9 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
   function flushWorkerIndexOnExit() {
     batch.flush();
     flushActiveWorkerRows();
-    // Writes are persisted by an async queue; the loop is gone at exit.
+    // Writes are persisted by an async queue; the loop is gone at exit. This
+    // is the best-effort last resort: a persist still running is left alone
+    // (the graceful shutdown path drains before exit).
     store.flushSync();
   }
 
@@ -181,25 +203,62 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
   const unregisterExitFlush = registerExitFlush(flushWorkerIndexOnExit);
   const unregisterApprovalWaits = registerApprovalWaitWriter(file, setAwaitingUser);
   let disposed = false;
+  let disposePromise = null;
+
+  function teardown() {
+    unregisterExitFlush();
+    unregisterApprovalWaits();
+    releaseStore();
+  }
+
+  async function drainThenTeardown() {
+    batch.flush();
+    await store.flush();
+    teardown();
+  }
 
   /** Persist queued rows, then release the exit registration. Active rows are
    *  NOT settled: they are keyed by process pid, which every inline runtime in
-   *  the daemon shares, so settling here would idle other runtimes' workers. */
+   *  the daemon shares, so settling here would idle other runtimes' workers.
+   *  When the sync flush cannot run (this process's async writer holds the
+   *  lock) the exit hook and store ref stay until the async drain settles. */
   function dispose() {
     if (disposed) return;
     disposed = true;
+    let flushed = false;
     try {
       batch.flush();
-      store.flushSync();
-    } finally {
-      unregisterExitFlush();
-      unregisterApprovalWaits();
-      releaseStore();
+      flushed = store.flushSync();
+    } catch {}
+    if (flushed) {
+      teardown();
+      return;
+    }
+    disposePromise = drainThenTeardown().catch(reopenAfterFailedDrain);
+  }
+
+  /** A failed drain tears nothing down; allow a later dispose to retry it. */
+  function reopenAfterFailedDrain() {
+    disposed = false;
+    disposePromise = null;
+  }
+
+  /** Awaitable dispose: drain everything, then tear down. A failed drain
+   *  rejects and leaves the registrations in place. */
+  function disposeAsync() {
+    if (!disposePromise) {
+      disposed = true;
+      disposePromise = drainThenTeardown().catch((error) => {
+        reopenAfterFailedDrain();
+        throw error;
+      });
     }
+    return disposePromise;
   }
 
   return {
     dispose,
+    disposeAsync,
     workerIndexPath: () => file,
     invalidateWorkerRowsCache: store.invalidate,
     readAllWorkerRows: store.readAll,

package/src/session-runtime/services/agent-tool.mjs

@@ -42,6 +42,9 @@ export function createStandaloneAgent({
   sessionSurface = null,
   awaitKeychainPrewarm = async () => {},
   isKeychainPrewarmReady = () => true,
+  // Provider model catalog for user-pinned spawn models; absent on surfaces
+  // without one, where only exact provider + model pass.
+  listProviderModels = null,
 }) {
   const canUseSessionSurface = (session) =>
     typeof sessionSurface?.runTurn === 'function' && sessionSurface.canRun?.(session) !== false;
@@ -105,6 +108,7 @@ export function createStandaloneAgent({
     sendFlow,
     closeFlow,
     terminalTrace,
+    listProviderModels,
   });
 
   function getStatus(context = {}) {
@@ -147,7 +151,10 @@ export function createStandaloneAgent({
     recoverWorkers,
     upsertLeadSession: registry.upsertLeadSession,
     updateLeadWorkerCwd: registry.updateLeadWorkerCwd,
+    forgetLeadSession: registry.forgetLeadSession,
     closeAll: closeFlow.closeAll,
     dispose: (options) => registry.dispose(options),
+    disposeAsync: (options) => registry.disposeAsync(options),
+    flushIndexWrites: () => registry.flushIndexWrites(),
   };
 }

package/src/session-runtime/services/agent-watchdog-registry.mjs

@@ -18,6 +18,8 @@ export function getProgressWatchdogState(mgr, sessionId) {
     registered: Boolean(state?.linked && !state.controller.signal.aborted),
     lastCheckedAt: state?.lastCheckedAt || null,
     error: state?.error || null,
+    // The policy this session's watchdog actually enforces.
+    policy: state?.watchdogPolicy || null,
   };
 }
 

package/src/session-runtime/services/channel-admin.mjs

@@ -26,6 +26,8 @@ import { normalizeAutomationAttachments } from '../../runtime/shared/automation-
 import { migrateCodexModelRef } from '../../runtime/agent/orchestrator/providers/openai-oauth-catalog-store.mjs';
 import { hasEnabledAutomation } from '../../runtime/shared/automation-presence.mjs';
 import { resolveScheduleTimezone, validateScheduleCron } from '../../runtime/shared/schedule-time.mjs';
+import { pgClusterExists } from '../../runtime/memory/lib/pg/adapter.mjs';
+import { resolvePluginData } from '../../runtime/shared/plugin-paths.mjs';
 import { readHookPublicBase } from '../../runtime/channels/lib/webhook/relay-tunnel.mjs';
 import { WEBHOOK_TEST_FIELD, WEBHOOK_TEST_HEADER } from '../../runtime/channels/lib/webhook/request-handler.mjs';
 
@@ -463,10 +465,20 @@ export async function testWebhook(name) {
 // and webhooks run sessions, so they must not require Discord/Telegram
 // tokens or an explicit remote toggle.
 async function checkActiveAutomation() {
-  const [schedules, webhooks] = await Promise.all([listSchedules(), listWebhooks()]);
+  const { schedules, webhooks } = await readAutomationRows();
   return hasEnabledAutomation({ schedules, webhooks });
 }
 
+// Read-only views (channel setup, the automation probe) never bring
+// PostgreSQL up for the first time: before initdb ran no schedule or webhook
+// can exist, and that first start — runtime download/extract plus initdb — is
+// seconds of work no catalog read should wait on. Writes still start it.
+async function readAutomationRows() {
+  if (!pgClusterExists(resolvePluginData())) return { schedules: [], webhooks: [] };
+  const [schedules, webhooks] = await Promise.all([listSchedules(), listWebhooks()]);
+  return { schedules, webhooks };
+}
+
 // Every session runtime in the process asks this at boot. Concurrent callers
 // join one in-flight check and a settled answer is reused for ttlMs, so N
 // runtimes booting together cost one PG query (and at most one PG boot)
@@ -519,8 +531,12 @@ export function hasActiveAutomation() {
   return automationProbe.probe();
 }
 
+// The daemon opens both stores in the background once ready (it settles
+// hasActiveAutomation), so on an existing cluster this read joins a
+// PostgreSQL start already under way instead of being the one that starts it.
 export async function channelSetup(config = null) {
   const cfg = normalizeChannelsConfig(config || readSection('channels'));
+  const { schedules, webhooks } = await readAutomationRows();
   return {
     webhook: {
       ...(cfg.webhook || {}),
@@ -528,7 +544,7 @@ export async function channelSetup(config = null) {
       // connects and mints its hook identity).
       publicUrl: readHookPublicBase(),
     },
-    schedules: await listSchedules(),
-    webhooks: await listWebhooks(),
+    schedules,
+    webhooks,
   };
 }

package/src/session-runtime/services/memory-runtime-proxy/calls.mjs

@@ -41,6 +41,9 @@ export function createMemoryCalls({ state, cwd, start, discovery, registry }) {
       ...(transcriptCwd ? { cwd: transcriptCwd } : {}),
     });
   }
+  async function forgetTranscripts(filePaths = []) {
+    return await requestMemoryPath('/transcript/forget', { filePaths }, { timeoutMs: 10_000 });
+  }
   async function recordTraceEvents(events = []) {
     return await requestMemoryPath('/admin/trace-record', { events }, { timeoutMs: 5_000 });
   }
@@ -120,6 +123,7 @@ export function createMemoryCalls({ state, cwd, start, discovery, registry }) {
     retain,
     appendEntry,
     ingestTranscript,
+    forgetTranscripts,
     recordTraceEvents,
     handleToolCall,
     buildSessionCoreMemoryPayload,